Stack Buffer Overflow in psqlODBC Parser for PostgreSQL by PostgreSQL Inc.

CVE-2026-120061

What is CVE-2026-120061?

The psqlODBC driver contains a vulnerability related to improper handling of ODBC escape sequences, where argument offsets are written to a fixed-size stack array without bounds checking and initialization. This oversight can lead to stack overflow when a {fn} escape includes an excessive number of arguments, allowing attackers to manipulate memory and potentially execute arbitrary code. Additionally, the vulnerability affects the copying of other escape sequence bodies, which can lead to further exploitation if untrusted SQL text is forwarded to the driver. It is crucial for users to update to version 18.00.0006 or later to mitigate this risk.

References